Description

An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mechanism of the Invoke script execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-17T23:16:52.360Z",
  "pubdate": "2026-08-17T23:16:52.360Z",
  "executiveSummary": "An arbitrary code execution vulnerability exists within the sandbox mechanism of the Invoke script execution in O2OA v.10.0.2. This security flaw enables a local attacker to bypass existing script execution restrictions and execute arbitrary code on the underlying host operating system.\nThe vulnerability affects O2OA version 10.0.2, specifically within its scripting engine implementation. Successful exploitation carries severe risk implications, potentially leading to full system compromise, data exfiltration, or unauthorized modification of system resources.\nThe attacker is required to have local access to the target system to leverage the vulnerability. Exploitation relies on interacting with the Invoke script execution functionality and successfully subverting the boundary enforcement of the sandbox mechanism to execute malicious payloads outside of intended security contexts.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient isolation and inadequate security controls within the sandbox mechanism utilized by the Invoke script execution feature in O2OA v.10.0.2. Sandboxing mechanisms in scripting engines are designed to restrict code execution to a safe, isolated environment, preventing access to system-level APIs, native libraries, or underlying operating system resources.\nIn this specific instance, the sandbox implementation fails to properly sanitize inputs, restrict dangerous class loaders, or block access to sensitive Java reflection APIs and runtime execution methods within the script evaluation context. Consequently, an attacker capable of submitting or modifying script content processed by the Invoke execution component can construct a payload that breaks out of the intended execution boundary.\nThe attack flow begins with the local attacker authenticating or accessing the O2OA v.10.0.2 environment where script execution is permitted. The attacker crafts a specialized script payload designed to interact with unrestricted runtime libraries or internal application objects accessible through the flawed Invoke script mechanism. By leveraging improper object deserialization, insecure reflection, or direct native method invocation allowed by the weakened sandbox, the attacker bypasses containment restrictions.\nOnce the sandbox restrictions are circumvented, the payload executes within the security context of the O2OA application process. Depending on the privileges assigned to the running application service, the attacker achieves arbitrary code execution, permitting post-exploitation activities such as reading sensitive configuration files, interacting with internal databases, or deploying persistent access mechanisms on the host system."
}